memory: Worldtree #365 demo config pre-sync STAGED (internal-comms tiers/rules + gate)

Staged the boot-blocking #365 delta on corviduo-dev DEMO /opt/worldtree/config
per worldtree-dev thread 01KXRE59 (verbatim from their 6a60fe3/b123 blocks):
internal + internal-restricted tiers, four internal-* rules, and the
internal_agent_comms:{enabled:false} gate. Validated via the demo container's
own PyYAML + the exact-set uniqueness guard; no restart (b123 activates off the
bind-mount). Backups .bak-pre-365. Flagged a pre-existing free==pro scope-set
dup to worldtree-dev as a b123 boot-block risk.

persistent-memory.md

@@ -119,7 +119,7 @@ _As of 2026-07-17 — active work is CONTAINERIZING the Zonos2 TTS engine + prot
 - **`stacks/heretic2-charrp-reasoning/` STILL UNTRACKED** — the char-rp-reasoning NVFP4+MTP stack; its live `.env` changed this session (util 0.38→0.46, max-len 153600→262144). Commit the stack.
 - **Re-arm the althing monitor** (`/althing:monitor`, handle `infra-ops`) — the wake-listener dies on /clear. Open watches: worldtree-dev (#363 research-wing ingest, PARKED no-deadline, auto-memory `project_worldtree_research_wing_ingest`) + comfy-dev (arbo→gen bake).
 - **irv-ml1 3090 oversubscription footgun** (operator declined to fix for now): kokoro (`:8193`) + vibevoicefusion (`:9527`) are idle-pinned to the full 3090 (~1.4 G free) → could OOM on load.
-- **Worldtree #365 DEMO config pre-sync — BOOT-BLOCKING, no urgency, UNBLOCKED + ready to stage** (worldtree-dev, thread `01KXRE59`; verbatim blocks in msg `01KXRE90`; also land in commit 6a60fe3/b123 once pushed). New `InternalCommsGateValidator` FATALs at boot if the demo bind-mount `policies.yaml` lacks the `internal`/`internal-restricted` tiers + the four `internal-*` rules; `defaults.yaml` needs an `internal_agent_comms:{enabled:false}` block (also FATAL-on-malformed). Pre-verified: the two new scope-sets are UNIQUE vs the demo's 7 existing tiers (won't trip the exact-set guard). **TO DO (focused pass, no restart — boot-cached):** on corviduo-dev DEMO `/opt/worldtree/config` — add the 2 tiers after `suspended:` + append the 4 `internal-*` rules to `policies.yaml`; append the `internal_agent_comms` block to `defaults.yaml`; validate via the container's yaml parser; leave staged (b123 deploy activates it; bind-mount shadows baked). Deferred from the snapshot-tail session (delicate FATAL-on-malformed). Demo-only (personal/staging wait for a staging tag). See [[reference_corviduo_dev_emergency_ops]].
+- **Worldtree #365 DEMO config pre-sync — STAGED 2026-07-17** (worldtree-dev, thread `01KXRE59`; verbatim from their 6a60fe3/b123 blocks in msg `01KXRE90`; confirmed staged in reply `01KXRV5J`). On corviduo-dev DEMO `/opt/worldtree/config`: added `internal`+`internal-restricted` tiers after `suspended:` + the 4 `internal-*` rules after `tool-baseline-allow` in `policies.yaml`; appended `internal_agent_comms:{enabled:false}` after `metrics:` in `defaults.yaml`. Backups `policies.yaml.bak-pre-365` / `defaults.yaml.bak-pre-365` (rollback = restore). vh:vh 644. Validated through the demo container's OWN PyYAML (worldtree-worldtree-api-1, e099cd3d) + replicated the exact-set uniqueness guard (both new scope-sets unique). NO restart — boot-cached, b123 deploy activates off the bind-mount. **OPEN:** (1) diff staged copy vs built files when 6a60fe3 actually pushes; (2) FLAGGED to worldtree-dev a PRE-EXISTING `free`==`pro` scope-set dup (`["tool.*","pending.read"]`) — if b123's startup validator is a GLOBAL all-tiers-unique check it'd FATAL b123 at boot independent of #365; awaiting their answer on whether the guard is global or internal-tiers-only. Demo-only (personal/staging wait for a staging tag). See [[reference_corviduo_dev_emergency_ops]].
 
 **Landed this session (2026-07-16→17), all pushed EXCEPT 14a0004:**
 - Memory **two-tier migration** (d710e56, 53 detail files, index 60→25 KB) + MEMORY.md auto-index compacted 30.5→14.6 KB (auto-memory, not this repo).